chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Permissions removed from operator ClusterRole

Resource	Verbs removed	Reason
opa.stackable.tech/regorules	create, get, list, watch, patch (entire rule)	Template leftover. The operator reads OPA connection info from a ConfigMap; it never creates or manages RegoRules.
""/nodes	list, watch (entire rule)	Template leftover. Only nodes/proxy GET is needed (to read kubelet /configz for cluster domain detection).
""/pods	create, delete, get, list, patch, update, watch (entire rule)	Operator never directly manages Pods. StatefulSets create Pods.
""/endpoints	create, delete, get, list, patch, update, watch (entire rule)	Kubernetes auto-creates Endpoints for Services; they are never directly managed.
batch/jobs	create, delete, get, list, patch, update, watch (entire rule)	Operator never creates Jobs. The orphan cleanup framework silently skips on 403.
update verb	all rules	SSA (apply_patch) uses HTTP PATCH. update (HTTP PUT) via client.update() is never called.
watch on ""/serviceaccounts	watch	Not in .owns() or .watches() in the controller.
watch on rbac.authorization.k8s.io/rolebindings	watch	Not in .owns() or .watches() in the controller.
watch on policy/poddisruptionbudgets	watch	Not in .owns() or .watches() in the controller.
watch on listeners.stackable.tech/listeners	watch	Not in .owns() or .watches() in the controller.
delete, list, watch on ""/secrets	delete, list, watch	Secrets are managed via direct client.get_opt() + client.apply_patch(), not via cluster_resources.add(). No orphan cleanup, no watch. Only create, get, patch needed.
patch on trinoclusters main resource	patch	Only apply_patch_status() is called (targets the /status subresource). The main resource is never directly patched by the operator.